CVE-2026-49740: TYPO3 CMS RCE Vulnerability

CVE-2026-49740 Overview

CVE-2026-49740 affects TYPO3 CMS, where the cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialize PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend, either the cache store or the sys_registry database table, can inject a crafted serialized payload. This triggers PHP Object Injection and can be chained with gadget classes to reach Remote Code Execution. The flaw is classified as Deserialization of Untrusted Data [CWE-502] and requires direct local write access to the storage layer.

Critical Impact
Attackers with write access to TYPO3 cache storage or the sys_registry table can achieve PHP Object Injection and potentially Remote Code Execution through gadget chain exploitation.

Affected Products

TYPO3 CMS versions before 10.4.57
TYPO3 CMS versions 11.0.0 through 11.5.51, 12.0.0 through 12.4.46
TYPO3 CMS versions 13.0.0 through 13.4.31 and 14.0.0 through 14.3.3

Discovery Timeline

2026-06-09 - CVE-2026-49740 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49740

Vulnerability Analysis

The vulnerability resides in two TYPO3 core components that consume PHP serialized data. VariableFrontend serializes arbitrary variables for caching, then calls unserialize() on retrieval without validating the payload origin or restricting allowed classes. The Registry class performs the same pattern against rows in the sys_registry table. An attacker who can write to either backend can plant a serialized object that, once read back, instantiates attacker-controlled classes and triggers magic methods such as __wakeup, __destruct, or __toString. Chaining these with available gadget classes can lead to file writes, command execution, or further state corruption inside the TYPO3 application.

Root Cause

Neither component authenticated stored serialized data, and neither used a class allowlist. The deserializer accepted any serialized PHP structure, making the implicit trust boundary between storage and application a direct attack surface.

Attack Vector

Exploitation requires local write access to the storage layer. This typically means SQL access to the sys_registry table or file system write access to the cache directory. Once a payload is injected, normal TYPO3 read operations on the cache or registry execute the deserialization.

php

// Patch excerpt: typo3/sysext/core/Classes/Cache/Frontend/VariableFrontend.php
namespace TYPO3\CMS\Core\Cache\Frontend;

use TYPO3\CMS\Core\Cache\Backend\TransientBackendInterface;
+use TYPO3\CMS\Core\Crypto\HashService;
+use TYPO3\CMS\Core\Serializer\AuthenticatedMessageDeserializer;
+use TYPO3\CMS\Core\Serializer\DeserializationService;
+use TYPO3\CMS\Core\Serializer\Exception\DeserializerException;
use TYPO3\CMS\Core\Utility\GeneralUtility;

Source: TYPO3 commit 48bcf24. The fix introduces HashService-backed authenticated message deserialization and a dedicated DeserializationService so cached payloads are integrity-checked before unserialize() runs. A parallel change in Registry.php adds DenyListDeserializer to block dangerous classes.

Detection Methods for CVE-2026-49740

Indicators of Compromise

Unexpected modifications to rows in the sys_registry database table, particularly entries containing PHP serialized object markers such as O: or C: prefixes.
New or modified files in TYPO3 cache directories (for example var/cache/) authored by non-TYPO3 processes or outside of normal deployment windows.
PHP error log entries referencing failed deserialization, missing classes, or __wakeup/__destruct execution from unusual call stacks.

Detection Strategies

Inspect sys_registry and cache backend contents for serialized payloads referencing classes outside the expected TYPO3 namespaces.
Correlate database write events to sys_registry with the source application user; writes from accounts other than the TYPO3 service user are suspicious.
Monitor PHP-FPM and web server processes for child process spawns following cache reads, which can indicate gadget chain execution.

Monitoring Recommendations

Enable file integrity monitoring on TYPO3 cache directories and alert on writes by non-application users.
Audit MySQL or MariaDB query logs for INSERT or UPDATE statements targeting sys_registry outside normal TYPO3 operations.
Forward TYPO3 application and PHP error logs to a central SIEM for anomaly correlation.

How to Mitigate CVE-2026-49740

Immediate Actions Required

Upgrade TYPO3 CMS to a fixed release: 10.4.57, 11.5.52, 12.4.47, 13.4.32, or 14.3.4.
Audit and restrict database accounts so only the TYPO3 application user can write to the sys_registry table.
Review file system permissions on cache directories and remove write access for any account that does not require it.

Patch Information

The TYPO3 project addressed the issue in commits 48bcf24 and 87cd7c5. The patches add an AuthenticatedMessageDeserializer backed by HashService for cache payloads and a DenyListDeserializer for the Registry. Full advisory details are available in the TYPO3 Security Advisory TYPO3-CORE-SA-2026-018.

Workarounds

Where immediate patching is not feasible, isolate the TYPO3 database and cache storage so no untrusted process or account holds write access.
Flush existing cache entries and clear sys_registry rows that cannot be attributed to legitimate application activity before patching.
Place the TYPO3 backend behind network controls that limit administrative and database access to known IP ranges.

bash

# Example: revoke unnecessary write privileges on sys_registry
REVOKE INSERT, UPDATE, DELETE ON typo3db.sys_registry FROM 'reporting_user'@'%';
FLUSH PRIVILEGES;